Can a third-party mail app read your email?
Whether a mail app can read your email depends on its design: direct to your provider, or through its own servers. Here is how to tell which one you have.
Sanjeev Maharjan5 min read
Any mail app can read your email on your own device: that is its job. The real question is whether the company that makes it can. That depends on the design. An app that connects your computer straight to your mail provider gives its maker nothing. An app that passes your mail, or your sign-in, through the maker's own servers gives the maker the means to read it.
The short version: find out whether the app's maker runs servers that hold your mail or your sign-in. The privacy policy tells you, if you know which words to look for. Then check what access you granted, and prefer an app that publishes every connection it makes.
The two designs
| Direct to your provider | Through the maker's servers | |
|---|---|---|
| Where your password or token is kept | On your device only | On the maker's servers |
| Who fetches your mail | Your device | The maker's servers, which pass it to the app |
| Can the maker read your mail? | It has no means to | It has the means; its policy says what it does |
| What you rely on | How the app is built | The maker's promises and its security |
Neither design is dishonest: a server in the middle allows features such as instant phone notifications. But it changes what you trust. With a direct app, a break-in at the maker exposes no mail, because the maker holds none. With a server in the middle, your mail is as safe as that company's systems, staff and future owners.
How to tell from the privacy policy
Search the policy for these words.
- "Our servers", "processed on", "stored on". A policy that says your messages are processed or stored on the company's servers is describing the second design.
- "Credentials", "access tokens". If the company stores your sign-in on its servers, even encrypted, those servers can sign in to your mailbox.
- "AI", "smart features". See whether email text goes through the maker's servers, or straight from your device to a provider you chose. The guide on bringing your own AI key for email explains the difference.
- What is missing. A policy that never says where your mail and password live has not answered the question. A clear one says it in the first paragraph.
App passwords and OAuth: what you are granting
There are two common ways to let a mail app into your account. Both are safe only when the secret stays on your device.
App passwords
An app password is a separate password your provider creates for one app, so you never type your main one. It usually opens all your mail over IMAP and SMTP, the standard mail protocols, and you can revoke it at any time in your account's security settings. See the guides to creating a Gmail app password for a Mac mail app and an app-specific password for iCloud Mail.
OAuth and its scopes
With OAuth you sign in on your provider's own page and approve a list of permissions, called scopes. The app receives a token, never your password. Reading, sending and deleting all your mail is a normal scope for a mail app; access to contacts, calendar or files should match something the app really does.
The consent screen shows what was granted, not where the token is kept. A token on your device serves only your device. A token on the maker's servers lets them act in your mailbox at any time, even when the app is closed.
What to check before you trust a mail app
- Read the top of the privacy policy for a plain statement of where your mail and sign-in are stored.
- Check whether you must create an account with the app maker. A direct app does not need one to read your mail.
- Look for a published, dated list of the connections the app makes.
- On a Mac, see where the app keeps passwords. The Keychain is the system's encrypted store; open Keychain Access and search for the app's name.
- In your mail account's security settings, review the apps with access and your app passwords. Remove any you no longer use.
Revoking is the real off switch. Deleting an app does not cancel a token held on a server. Your mail provider's security page is the one place that can cut an app off for certain.
How Mailvie is built
Mailvie, a mail app for the Mac, uses the first design. Your Mac connects straight to your mail provider over IMAP and SMTP, and we run no server that could see your mail, contacts or passwords. There is no Mailvie account.
- In version 0.1.0 you add Gmail, iCloud and Yahoo with an app password, and other providers with their IMAP details. Outlook and Microsoft 365 sign-in is not in this version.
- Passwords and AI keys are stored in the macOS Keychain on your Mac.
- AI runs only with your own key, and the email text goes from your Mac to that provider when you ask.
- The app contains no analytics. It checks for updates and announcements, and the direct-download build checks its licence with our payment provider.
Each of those connections, with when it happens and what is sent, is on the published list of connections. The website is a separate matter: it records downloads and buy clicks, and the privacy page says so. You can download Mailvie for Mac (Apple Silicon, macOS 14 or later), or ask where your data goes through the support page.
Questions people ask
Can a mail app read my email after I delete it?
If the app kept your sign-in only on your device, deleting it ends its access. If the maker's servers hold a token, they can keep reaching your mailbox until you revoke access in your mail provider's security settings.
Is an app password safer than signing in with OAuth?
Neither is safer in every case. An app password usually opens all your mail and can be revoked at any time. OAuth can grant narrower access. What matters more is whether the secret stays on your device.
Does my mail provider still see my email?
Yes. Your mail lives on your provider's servers whichever app you read it with. Choosing a direct mail app removes a second company from the picture; it does not change what your provider holds.
How do I see which apps have access to my mailbox?
Open the security section of your mail account on the provider's website. It lists the apps you approved and the app passwords you created, with a way to remove each one.
Written by Sanjeev Maharjan
Sanjeev Maharjan builds Mailvie, a mail app for the Mac. Found a mistake in this guide? Write to [email protected].
